Measurement of Data Traffic Measurement of Data Traffic in Cellular - PowerPoint PPT Presentation

Measurement of Data Traffic Measurement of Data Traffic in Cellular Networks 2008.8.16 Kisu Kim, Hyeongu Son, Taeck-keun Kwon, DK Lee*, S. Moon* and Youngseok Lee, Chungnam National University *KAIST D Daejon, Korea j K 1

Contents Contents • Overview • Basic measurement result Basic measurement result • Result of content classification • Summary 2

3G Cellular Data Networks in Korea • 3G data networks – GSM/UMTS (3GPP) family • UMTS/W-CDMA (3G): HSDPA (High-Speed Downlink Packet Access) – CDMA (3GPP2) family CDMA (3GPP2) family • CDMA-2000 (3G): EVDO (Evolution Data Only/Optimization) – Provides always-on connectivity services – Provides always on connectivity services • In a mobile environment: even in the express train at the speed of 300Km/H CDMA 1x EVDO WCDMA/HSDPA Uplink Uplink 153 6Kbps 153.6Kbps 2Mbps 2Mbps Downlink 2.4Mbps 14.4Mbps 3

3G Subscribers in Korea 3G Subscribers in Korea http://www.giikorea.co.kr/press/IU57012 kr.html p // g /p / _ 4

Our Work Our Work • Measurement and classification of EVDO/HSDPA data traffic / • To answer the questions like – What is the trend of protocol and port Wh t i th t d f t l d t breakdown ? • Similar in the typical wired Internet ? – Which kind of contents are people using ? 5

Collected Traffic Collected Traffic • One of major cellular carriers in Korea • CDMA 1x EVDO CDMA 1x EVDO – Eight 30-min traces on different days in 2008 2008 • WCDMA HSDPA – Eight 30-min traces on different days in 2008 6

Measurement Environment Measurement Environment Access Network Core Network Core Network SGSN RNC BS Intra-PLMN backbone GGSN IP Traffic Collector Data network PLMN: GSM Public Land Mobile Network SGSN: Serving GPRS Support Node GGSN: Gateway GPRS Support Node Internet PDSN P PDSN: Packet Data Service Node k t D t S i N d RNC: Radio Network Controller BS: Base Station 7

Protocol Breakdown Protocol Breakdown 8

Protocol Breakdown (contd) Protocol Breakdown (cont’d) CDMA 1x EVDO WCDMA / HSDPA Download Upload Download Upload Byte : 61.6 Byte : 66.7 Byte : 82.9 Byte : 87.5 TCP (%) Pkts : 53.7 Pkts : 86.0 Pkts : 71.8 Pkts : 87.4 Byte : 38.1 B te : 38 1 B te : 32 7 Byte : 32.7 B te : 17 0 Byte : 17.0 B te : 12 0 Byte : 12.0 UDP (%) Pkts : 45.8 Pkts : 13.3 Pkts : 27.9 Pkts : 12.1 RTP/UDP RTP/UDP 95.19 3.89 87.78 0.68 (byte %) RTP/Total 35.41 1.05 15.32 0.07 (b te %) (byte %) 9

Port Breakdown Port Breakdown CDMA 1x EVDO WCDMA / HSDPA Download Upload Download Upload Rank (Src. Port) (Dst. Port) (Src. Port) (Dst, port) TCP TCP UDP UDP TCP TCP UDP UDP TCP TCP UDP UDP TCP TCP UDP UDP 1 9093 15000 9093 1813 80 6970 80 1814 2 2 80 80 15006 15006 8082 8082 5060 5060 9093 9093 15004 15004 9093 9093 4500 4500 3 7231 15004 80 15321 7231 4500 443 10001 4 4 7237 7237 15002 15002 12100 12100 53 53 554 554 15006 15006 8082 8082 10000 10000 5 7236 15008 443 13771 443 5004 20 137 9093 : WAP protocol over HTTP 80 : HTTP 7231 : authentication for downloading music g Around 15000 : for listening to music 10

TCP Src Port TCP Src Port - Downlink Downlink 11

TCP Dst Port TCP Dst Port – Uplink Uplink 12

UDP Src Port UDP Src Port - Downlink Downlink 13

UDP Dst Port UDP Dst Port - Uplink Uplink 14

Interesting Port: 9093 Interesting Port: 9093 • Port 9093 – WAP over HTTP – Classification of cellular “service types” in HTTP request packets 15

Port 80 Port 80 • Mobile terminals access to web via port 80 ? – Mostly by PCs not by cellular phones • Classification of terminal types with “agent” in Classification of terminal types with agent in HTTP packets Byte count(%) Packet count(%) Laptops/PCs 66 69 Cellular phone 0.006 0.009 16

Content Classification of HTTP Traffic • For Internet traffic classification F I t t t ffi l ifi ti – Traditional methods that use • Port number • Port number • Payload signatures • Behaviors/Machine learning – Classification of traffic: web, p2p, email, ftp • Content classification of HTTP traffic – E.g.) Web traffic is 40%. Which contents are people using with web traffic ? l i i h b ffi ? • Searching popular keywords, reading news, shopping 17

How to Classify Contents of HTTP y Traffic ? Analyze servers’ log data Analyze servers log data • – Easy – but limited to • Only content providers Inspect packets • – Difficult • May have privacy issues – ISPs as wells as content providers p • Even campus network operators can classify the campus networks’ Internet usage pattern – What do we find by inspecting HTTP packets ? • Specific “strings” that provide hints for classification S ifi “ t i ” th t id hi t f l ifi ti • We need language-specific information: A lot of contents are localized 18

Overview of Content Classification for HTTP Packets Classifying HTTP Capturing HTTP Finding Korean Packets with Korean Packet Strings Strings Strings Content Classification Dictionary Korean Strings Content Category “news”, name of news News company, … “*.mp3”, name of songs and Music singers singers, … 19

Typical Korean Encoding Typical Korean Encoding • KS C 5601 – KS X 1001, 0xB0A1(가) ~ 0xC8FE(힝) – 2 Bytes, Korean character set – 2350 syllables • EUC-KR – KS X 1003( ≑ ASCII) + KS X 1001 – 2 Bytes • Unicode : – U+AC00(가) ~ U+D7A3(힣), Korean character set -- 11172 가 힣 h • UTF-8 – U+0800 ~ U+FFFF : 3 Byte encoding U 0800 U FFFF 3 B t di • UTF-16 – U+0800 ~ U+FFFF : 2 Byte encoding U+0800 ~ U+FFFF : 2 Byte encoding 20

Example of Finding Korean String p g g [서울신문]밝은 색 진 [서울신문]밝은 색 진 바지와 손바닥만 한 핸드백, 얇은 벨트와 깃털 머리 장식용품…. 멋쟁이라면 올해 눈여 charset:=KS_C_5601_1987/r/n 겨봐야 할 0xBCAD 서 0xBFEF 울 0xBDC5 신 0xB9AE 문 0xB9E0 밝 0xC0BA 은 0xBBF6 색 … 21

Examples of Classifying HTTP y g Packets by Packet Inspection • Contents delivered in HTTP packets – Listening to music ste g to us c – Reading news Reading news – Browsing stock information 22

Listening to Music with Cellular g Phone in HTTP card id="menu" newcontext="true" title="검색결과 : [3/6]" title 검색결과 : [3/6] 검색어 : 검색어 : kcm do type "vnd skmn1“ lab type="vnd.skmn1“ lab el="일년전 오늘-KCM 23

Stock Information Stock Information SK증권* 12:38(현재) 12:38(현재) 3,715원 , 원 ▼90원 24

Reading News Reading News [서울신문]밝은 색 진바지와 손바닥만 한 핸드백, 얇은 벨트와 깃털 머리 장 식용품…. 멋쟁이라면 올해 눈여겨봐야 할 25

Experimental Results Experimental Results • HTTP packet traces – CDMA 1x EVDO C O – WCDMA HSDPA – Port 9093 in HTTP 26

Content Classification of Port 9093 Traffic EVDO EVDO HSDPA HSDPA C ONTENTS C ATEGORIES Access Count Packet Access Count Packet % % % % Music/Video Streaming/D Music/Video Streaming/D 12.54 14.01 15.03 15.52 ownloading Entertainment Adult 0.42 0.18 0.47 0.18 G Game 10 24 10.24 5 47 5.47 10 16 10.16 6 06 6.06 Shopping 2.54 2.96 3.30 2.89 Commerce Stocks 4.29 6.20 2.73 2.29 News & Web News & Web 25.66 25.66 27.54 27.54 24.26 24.26 29.38 29.38 Community 7.23 7.32 7.46 7.24 Information Customer service 20.13 11.15 31.35 16.52 Police enforcement 1 18 1.18 4 57 4.57 0 15 0.15 0 03 0.03 information Public informati Transportation information 0.59 0.22 0.53 0.20 on (bus map) Public advertisement 0.88 0.29 0.16 0.03 27 N.A. N.A. 1.41 20.08 4.40 19.65

Summary Summary • Data traffic in cellular networks D t t ffi i ll l t k – Dominant TCP – Popular UDP/RTP streaming p / g • Content classification – Language-specific HTTP traffic classification • Useful for finding user behaviors of using Web services • Future work – Supporting several Korean codes – Automatically building a classification dictionary A tomaticall b ilding a classification dictionar – Experiments with various HTTP packet traces – Extension with other languages g g 28